Privacy policy

This policy covers the Android app Workout Debt (package com.viburys.workoutdebt). It explains what personal data the app processes, why, for how long, and what your rights are under the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller of your personal data is Mindaugas Viburys, Lithuania, who publishes the app as Viburys. For anything about privacy, email support@viburys.com.

Data that stays on your phone

Everything you enter in the app stays in the app's private storage on your phone. That includes your workouts, targets, logged reps, debt history, reminder times and settings. We have no server, so we can't see this data, and it isn't sent to us or anyone else. Uninstalling the app or clearing its storage deletes it.

Android backup

If backup is turned on in your phone's settings, Android includes the app's workout database and settings in your device backup, and copies them when you move to a new phone. The backup is stored by Google in your own Google account, under Google's privacy policy. We have no access to it. You can turn backup off in Android's settings.

Crash reports

The app uses Firebase Crashlytics, a service from Google, to report crashes and serious errors, such as the app freezing. A report is sent the next time the app runs after the error. It contains:

• technical details of the error, such as which part of the app's code failed;
• the phone model, Android version, app version and build type;
• the phone's state at the time, such as free memory and storage, and whether the phone is rooted;
• a random identifier that Firebase creates for this installation of the app.

Reports don't contain your workouts, your name, your email or your Google account. When a report is sent, Google also receives your phone's IP address, as with any internet connection.

Why

To find and fix the bugs that make the app crash.

Legal basis

Our legitimate interest in keeping the app working (Article 6(1)(f) GDPR). The reports are limited to what's needed to fix errors and aren't linked to who you are.

Who receives them

Google LLC processes the reports on our behalf as our processor. The data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the transfer is also covered by the Standard Contractual Clauses in Google's data processing terms. More inPrivacy and Security in Firebase.

How long

Crashlytics deletes reports automatically after 90 days.

Purchases

Premium is sold through Google Play. Google handles the payment as an independent controller, underGoogle's privacy policy. The app only learns from Google Play whether you've bought Premium, and it keeps that answer on your phone. We never receive your card or other payment details.

For accounting, Google Play gives us records of each order, such as the order number, product, price, date and country. We use them to keep our books (Article 6(1)(c) GDPR: legal obligation) and to handle refunds and support requests about a purchase (Article 6(1)(b) GDPR: contract). We keep them as long as Lithuanian accounting law requires.

Notifications and widgets

Reminders are scheduled and shown by the app on your phone. No notification service or server is involved. Home screen widgets read the same on-device data as the app.

If you email us

If you write to support@viburys.com, we use your email address and message to reply (Article 6(1)(f) GDPR: legitimate interest in answering you). Mail to viburys.com addresses is forwarded by Cloudflare and stored in Google's Gmail. We keep the conversation only as long as we need it to help you, and delete it on request.

What the app doesn't do

• No account or sign-in.
• No ads, no analytics and no tracking across apps or websites.
• No access to your location, contacts, photos, microphone or camera.
• We don't sell or share personal data with anyone, except the service providers named above.

Children

Workout Debt isn't aimed at children under 13, and we don't knowingly process their personal data. If you believe a child has contacted us, email us and we'll delete the conversation.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interest, and to data portability. To use any of these rights, email support@viburys.com. We'll answer within one month.

Crash reports don't contain anything that identifies you, so we usually can't tell which reports came from your phone. Your workout data never reaches us: you control it on your phone, and you can delete it at any time by clearing the app's storage or uninstalling the app.

You also have the right to complain to a data protection authority. In Lithuania that's the State Data Protection Inspectorate (vdai.lrv.lt). You can also complain to the authority in the EU country where you live or work.

Changes to this policy

If the app starts handling personal data differently, we'll update this page and the date at the top before the change reaches the app. Important changes will also be mentioned in the app's release notes on Google Play.